SAMMY UI is optimized for resolutions with a width 1024px and higher.
Cybersecurity Fundamentals
Browse Cybersecurity...
PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)
PR.IP-2: A System Development Life Cycle to manage systems is implemented
PR.IP-3: Configuration change control processes are in place
PR.IP-4: Backups of information are conducted, maintained, and tested
PR.IP-5: Policy and regulations regarding the physical operating environment for organizational assets are met
PR.IP-6: Data is destroyed according to policy
PR.IP-7: Protection processes are improved
PR.IP-8: Effectiveness of protection technologies is shared
PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed
PR.IP-11: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)
PR.IP-12: A vulnerability management plan is developed and implemented
Maturity Level 2
Maturity Level 3
PR.IP-1.1
PR.IP-1.1: The organization shall develop, document, and maintain a baseline configuration for the its business critical systems.
  • This control includes the concept of least functionality.
  • Baseline configurations include for example, information about organization's business critical systems, current version numbers and patch information on operating systems and applications, configuration settings/parameters, network topology, and the logical placement of those components within the system architecture.
  • Network topology should include the nerve points of the IT/OT environment (external connections, servers hosting data and/or sensitive functions, DNS services security, etc.).
Documentation Maturity
Not applicable - Not applicable in the selected scope.
Level 1 - Initial - No Process documentation or not formally approved by management.
Level 2 - Repeatable - Formally approved Process documentation exists but not reviewed in the previous 2 years.
Level 3 - Defined - Formally approved Process documentation exists, and exceptions are documented and approved. Documented and approved exceptions < 5% of the time.
Level 4 - Managed - Formally approved Process documentation exists, and exceptions are documented and approved. Documented and approved exceptions < 3% of the time.
Level 5 - Optimizing - Formally approved Process documentation exists, and exceptions are documented and approved. Documented and approved exceptions < 0,5% of the time.
Implementation Maturity
Not applicable - Not applicable in the selected scope.
Level 1 - Initial - Standard process does not exist.
Level 2 - Repeatable - Ad-hoc process exists and is done informally.
Level 3 - Defined - Formal process exists and is implemented. Evidence available for most activities. Less than 10% process exceptions.
Level 4 - Managed - Formal process exists and is implemented. Evidence available for all activities. Detailed metrics of the process are captured and reported. Minimal target for metrics has been established. Less than 5% of process exceptions.
Level 5 - Optimizing - Formal process exists and is implemented. Evidence available for all activities. Detailed metrics of the process are captured and reported. Minimal target for metrics has been established and continually improving. Less than 1% of process exceptions.
Description

The organization shall develop, document, and maintain a baseline configuration for the its business critical systems.